CVE-2026-52964: Linux ALSA USB MIDI 2.0 Descriptor Out-of-Bounds Read

Technical summary

The ALSA USB audio subsystem contains a bounds-checking gap in its MIDI 2.0 endpoint descriptor parser. While the code validates the bLength field against bNumGrpTrmBlock before accessing the baAssoGrpTrmBlkID[] array, it does not enforce these bounds checks for subsequent reads during endpoint-extra descriptor walking. A malicious or malformed USB device can craft endpoint descriptors with invalid length values, causing the parser to read past allocated buffer boundaries. The vulnerability stems from inconsistent validation logic compared to the legacy MIDI parser, which this code mirrors. Rejection of zero-length and overlong descriptors during the scanning process closes the gap.

Business impact

Affected organizations face localized availability risk: a user connecting a malicious USB device could crash kernel MIDI handling, disrupting audio production workflows or real-time communication systems that rely on MIDI input. Information disclosure risk is lower but non-zero—kernel memory leaks could expose sensitive data. The attack surface is limited by the need for physical device access and user-level interaction, making this primarily a concern for organizations that permit USB device connections on production or critical systems (studios, broadcast facilities, music production environments).

Affected systems

The Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem across all versions prior to patching. Any system running a vulnerable kernel that has USB MIDI 2.0 device support enabled can be affected. Exposure requires the ability to connect and enumerate a USB device, so headless servers without USB ports and restricted endpoint access are at minimal risk. Workstations, laptops, and edge devices with USB connectivity are more broadly exposed.

Exploitability

Exploitation requires local access to connect a USB device and trigger MIDI device enumeration. No user credentials or elevated privileges are needed for the initial triggering event (a low-privileged user can connect a USB device), but the attack cannot be executed remotely. The vulnerability does not provide privilege escalation; it causes a denial of service or potential information leak at the privilege level of the kernel. Creating a working proof-of-concept requires crafting a malformed MIDI 2.0 USB device, which is non-trivial but well within reach of a motivated attacker with hardware skills or access to USB emulation tools.

Remediation

Apply kernel patches that enforce strict boundary validation during endpoint descriptor scanning for MIDI 2.0 devices. Verify your Linux distribution's security advisory for specific patched kernel versions. As a temporary mitigation, disable USB device enumeration for untrusted connections or restrict physical USB port access to trusted users. Monitor system logs for unexpected kernel crashes or ALSA errors originating from USB device initialization.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Ubuntu, Debian, SUSE, etc.) for patched kernel versions addressing CVE-2026-52964. Patch deployment varies by distribution and kernel branch; verify your current version against the vendor advisory before updating. Most distributions backport fixes to supported kernel versions within 1–2 weeks of public disclosure. Test patches in a staging environment if MIDI functionality is critical to your workflow before deploying to production systems.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for segmentation faults, general protection faults, or out-of-bounds memory access warnings coinciding with USB device connections. Set up alerts on ALSA subsystem errors tagged with 'descriptor' or 'endpoint'. Network-level detection is not feasible; focus on host-based indicators. Endpoint detection and response (EDR) solutions may flag kernel crashes as anomalies if properly tuned. On systems where USB device connections should never occur, any USB enumeration event is itself suspicious.

Why prioritize this

This vulnerability merits prompt but not emergency patching. Its CVSS score of 5.5 (Medium) reflects the local-access requirement and limited exploitability, yet the attack surface spans all Linux systems with USB and ALSA support. Prioritize patching on systems where untrusted USB devices could be connected (workstations, kiosks, research environments) ahead of isolated servers. It is not currently tracked in the CISA KEV catalog, indicating no active exploitation in the wild at time of publication, but that status can change quickly as patches roll out.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity with local attack vector, low complexity, low-privilege requirement, no user interaction, and high availability impact (system crash). Confidentiality and integrity impacts are rated as None, acknowledging that while memory disclosure is theoretically possible, the primary danger is denial of service. The attack vector is explicitly local (AV:L), preventing remote exploitation. Organizations that tightly control USB device access should rate their personal risk lower; those with open physical access to systems should rate it higher.

Frequently asked questions